Cilium Networking Concepts Quiz
Supported Version: Cilium 1.17 Last Updated: February 22, 2026
OSI Model and Basic Concepts
Which layer of the OSI model does Cilium primarily operate at?
- A) L2 (Data Link Layer)
- B) L3/L4 (Network/Transport Layer)
- C) L7 (Application Layer)
- D) All layers from L3 to L7
Show Answer
Answer: D) All layers from L3 to L7
Explanation: Cilium provides networking and security features not only at L3/L4 (IP addresses, ports) but also up to L7 (HTTP, gRPC, Kafka, etc.) layers.
Which of the following is an L2 (Data Link Layer) address?
- A) IP address
- B) MAC address
- C) Port number
- D) URL
Show Answer
Answer: B) MAC address
Explanation: A MAC (Media Access Control) address is a unique identifier for a network interface card and is used at the L2 layer.
Which of the following is an L3 (Network Layer) protocol?
- A) TCP
- B) UDP
- C) IP
- D) HTTP
Show Answer
Answer: C) IP
Explanation: IP (Internet Protocol) is a protocol responsible for packet routing at the network layer (L3).
Container Networking
What is Cilium's default network model?
- A) Bridge mode
- B) Overlay network
- C) Underlay network
- D) Host network
Show Answer
Answer: B) Overlay network
Explanation: Cilium uses an overlay network model using VXLAN or Geneve by default.
What is the default overlay protocol used by Cilium?
- A) VXLAN
- B) GRE
- C) IPsec
- D) MPLS
Show Answer
Answer: A) VXLAN
Explanation: Cilium uses the VXLAN (Virtual Extensible LAN) protocol by default to configure overlay networks.
What is the main benefit of Cilium's Direct Routing mode?
- A) Higher security
- B) Better compatibility
- C) Lower latency and higher throughput
- D) Easier setup
Show Answer
Answer: C) Lower latency and higher throughput
Explanation: Direct Routing mode provides lower latency and higher throughput because it does not use overlay encapsulation.
IP Address Management (IPAM)
What is Cilium's default IPAM mode?
- A) Kubernetes Host Scope
- B) Cluster Scope
- C) CRD-based
- D) AWS ENI
Show Answer
Answer: B) Cluster Scope
Explanation: Cilium's default IPAM mode is Cluster Scope, which allocates IP addresses centrally across the entire cluster.
What is the recommended IPAM mode when using Cilium on AWS EKS?
- A) Kubernetes Host Scope
- B) Cluster Scope
- C) AWS ENI
- D) CRD-based
Show Answer
Answer: C) AWS ENI
Explanation: On AWS EKS, it is recommended to use AWS ENI IPAM mode to directly allocate VPC IP addresses to Pods.
What Kubernetes feature does Cilium's IPAM 'PodCIDR' mode utilize?
- A) NodeSpec.PodCIDR
- B) NodeSpec.CIDR
- C) NodeSpec.Subnet
- D) NodeSpec.IPRange
Show Answer
Answer: A) NodeSpec.PodCIDR
Explanation: Cilium's PodCIDR IPAM mode utilizes the NodeSpec.PodCIDR field assigned by Kubernetes to each node.
Services and Load Balancing
Which feature is NOT provided by Cilium's kube-proxy replacement mode?
- A) ClusterIP service support
- B) NodePort service support
- C) LoadBalancer service support
- D) Service mesh functionality
Show Answer
Answer: D) Service mesh functionality
Explanation: Cilium's kube-proxy replacement mode supports basic Kubernetes service types, but service mesh functionality is provided through a separate Cilium Service Mesh feature.
What algorithms does Cilium use for service load balancing?
- A) Round robin
- B) Least connections
- C) IP hash
- D) All of the above
Show Answer
Answer: D) All of the above
Explanation: Cilium supports various load balancing algorithms including round robin, least connections, and IP hash.
What does Cilium's Global Service feature enable?
- A) Globally distributed service access
- B) Service load balancing across multiple clusters
- C) Global IP address allocation
- D) Global network policy application
Show Answer
Answer: B) Service load balancing across multiple clusters
Explanation: Cilium's Global Service feature enables load balancing for the same service across multiple clusters through Cluster Mesh.
Network Policies
What does the 'toCIDR' rule in Cilium network policies allow?
- A) Traffic to specific IP address ranges
- B) Traffic to specific domain names
- C) Traffic to specific services
- D) Traffic to specific ports
Show Answer
Answer: A) Traffic to specific IP address ranges
Explanation: The toCIDR rule is used to allow traffic to specific IP address ranges (in CIDR notation).
What does the 'world' entity mean in Cilium network policy 'toEntities' rules?
- A) All internal cluster endpoints
- B) All external networks
- C) All nodes
- D) All namespaces
Show Answer
Answer: B) All external networks
Explanation: The 'world' entity means all networks external to the cluster.
Which protocol is NOT supported in Cilium's L7 policies?
- A) HTTP
- B) gRPC
- C) Kafka
- D) SMTP
Show Answer
Answer: D) SMTP
Explanation: Cilium supports L7 protocols such as HTTP, gRPC, and Kafka, but does not support SMTP by default.
Advanced Networking Concepts
What protocols can be used in Cilium's Transparent Encryption feature?
- A) IPsec
- B) WireGuard
- C) Both A and B
- D) TLS
Show Answer
Answer: C) Both A and B
Explanation: Cilium can encrypt traffic between nodes using both IPsec and WireGuard.
What technology does Cilium's Multi-cluster feature use?
- A) Cluster Federation
- B) Cluster Mesh
- C) Multi-cluster Networking
- D) Global Cluster
Show Answer
Answer: B) Cluster Mesh
Explanation: Cilium uses Cluster Mesh technology to provide connectivity between multiple Kubernetes clusters.
What is possible through Cilium's BGP support?
- A) Route exchange with external routers
- B) External IP advertisement for LoadBalancer services
- C) Direct routing between clusters
- D) All of the above
Show Answer
Answer: D) All of the above
Explanation: Cilium's BGP support enables route exchange with external routers, external IP advertisement for LoadBalancer services, and direct routing between clusters.
What is the main purpose of Cilium's Egress Gateway feature?
- A) Preserving the source IP address of external traffic
- B) Changing the destination IP address of external traffic
- C) Encrypting external traffic
- D) Blocking external traffic
Show Answer
Answer: A) Preserving the source IP address of external traffic
Explanation: Egress Gateway SNATs traffic going from Pods to outside the cluster to a specific IP, providing a consistent source IP.
Which statement is correct about Cilium's Host Routing feature?
- A) Routing between host network and Pod network
- B) Direct routing between hosts
- C) Host network interface protection
- D) Host-based load balancing
Show Answer
Answer: B) Direct routing between hosts
Explanation: Cilium's Host Routing provides direct routing between hosts without an overlay network.